CertiK reviewed Baby Doge (Baby Doge DEX) on 6 Oct 2022: 18 findings, 0 critical; 7 marked fixed, 11 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 2 | 0 | 1 |
| Medium | 0 | 0 | 1 |
| Low | 9 | 0 | 5 |
In the function `swaptoBuyBack()`, the following code snippet is implemented to swap a certain amount of `WETH` for `buyBackCoin1`. However, the amount of `WETH` that is used to buy back the token is mistakenly set to `buyBackAmount0`, which should be `buyBackAmount1` ```solidity=337 if (buyBackCoin1 != address(0)) { address[] memory path = new address[](2); path[0] = WETH; path[1] = buyBackCoin1; uint256[] memory amountOutMin = IBabyDogeV2Router02(router) .getAmountsOut(buyBackAmount0, path); IBabyDogeV2Router02(router).swapExactTokensForTokens( buyBackAmount0, amountOutMin[1], path, address(this), block.timestamp + 120 ); } ```
In the function `swaptoBuyBack()`, the deadline for the `IBabyDogeV2Router02(router).swapExactTokensForTokens` is set to `block.timestamp + 1200`, which is 20 minutes more than the block.timestamp. However, other swap deadlines are all set to `block.timestamp + 120`, which brings the inconsistency
When the pool has stopped, the invocation of the function `stopReward()` may potentially extend the reward activity if `block.number` is given a value that is greater than the current `bonusEndBlock` by mistake. In this case, users can withdraw extra rewards which will cause a loss of the pool's assets.
Currently in the function `updatePoolLimitPerUser()`, once `hasUserLimit` was set to `false`, it can no longer be set to `true` through function `updatePoolLimitPerUser()`. Does this mean once the limit was removed, then it cannot be reset in the future?
```solidity require( _toBuyBackCoin0Percent <= 10000, "Has to be 10000" ); ``` The message should be "Has to be no more than 10000". --- Moreover, in L380 in contract `dexBuyBackFeeManager.sol`: ```solidity require(msg.sender == tx.origin, "Only Wallet"); ``` The message should be "Only EoA Wallet" or similar message because the wallet could be EoA or a wallet contract implementation.
In the function `addLP()` and `replaceLP()`, `_pathTokenA` and `_pathTokenB` would be a path tokens that would be used in the AMM swap. However there's possibility that the `_pathTokenA` and `_pathTokenB` could be mistakenly inputted with same token calldata.
In the contract `dexTreasuryFeeManager` contract at the address of [0x1B6878aDfB16B949a8ceF2fB28228AFC84FCb6a8](https://bscscan.com/address/0x1B6878aDfB16B949a8ceF2fB28228AFC84FCb6a8#code), the if statement condition `instantSwapToStable == true` is redundant as the default value of `instantSwapToStable` is true and there's no other function to change its value.
| Address | Chain | Source code |
|---|---|---|
| 0xbda7…9c740xbda7c402f9de8ad737cedc3ab7cbfecd53f29c74 | Chain: BNB Chain | Source code: Verified source |
| 0x1b68…b6a80x1b6878adfb16b949a8cef2fb28228afc84fcb6a8 | Chain: BNB Chain | Source code: Verified source |
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us